Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline
Researchers identified an exposed web directory on infrastructure supporting a cryptocurrency fraud operation tracked as Operation ASTERIX. The server contained phone-number datasets, account-validation tools, phishing panels, voice-dialing scripts, and fake wallet applications for Ledger, Trezor, and Exodus. The operator validated approximately 885,000 phone numbers against cryptocurrency exchange accounts, achieving a 13.6% hit rate on German numbers. Victims received coordinated phishing emails and vishing calls referencing fake support cases before being directed to counterfeit wallet applications designed to steal recovery phrases via Telegram exfiltration. Notable findings include extensive use of AI coding assistants throughout development, including GitHub Copilot and Claude Code. When one AI model resisted malicious requests, the operator switched providers and attempted to bypass safety controls using a structured jailbreak prompt targeting the model's reasoning patterns and safety mechanisms.
AI Analysis
Technical Summary
Researchers uncovered an exposed web directory supporting Operation ASTERIX, a cryptocurrency fraud operation. The server contained extensive resources including phone-number datasets, account-validation tools, phishing panels, voice-dialing scripts, and fake wallet applications for Ledger, Trezor, and Exodus. The operator validated approximately 885,000 phone numbers against cryptocurrency exchange accounts, with a 13.6% success rate on German numbers. Victims received coordinated phishing emails and vishing calls referencing fabricated support cases, leading them to counterfeit wallet applications designed to steal recovery phrases, which were exfiltrated via Telegram. The fraud operation used AI coding assistants such as GitHub Copilot and Claude Code extensively during development. When one AI model resisted malicious requests, the operator switched providers and used structured jailbreak prompts to bypass AI safety controls targeting the model's reasoning and safety mechanisms.
Potential Impact
The campaign enables attackers to steal cryptocurrency wallet recovery phrases through coordinated phishing and vishing attacks, potentially resulting in theft of victims' cryptocurrency assets. The use of validated phone numbers increases the likelihood of successful targeting. The counterfeit wallet applications facilitate direct theft of sensitive wallet credentials. The use of AI-assisted development and jailbreak prompts indicates a sophisticated approach to tool creation and evasion of AI safety mechanisms.
Mitigation Recommendations
No official patch or fix applies as this is a fraud campaign rather than a software vulnerability. Defenders should educate users about phishing and vishing tactics, especially related to cryptocurrency wallets. Users should verify communications purportedly from wallet providers or exchanges independently and avoid installing wallet applications from untrusted sources. Monitoring for the listed domains and hashes associated with the campaign can aid detection and blocking. Awareness of AI-assisted fraud tool development may inform threat hunting and defense strategies.
Affected Countries
United States, Bulgaria, Canada, Germany, Hong Kong, Poland
Indicators of Compromise
- domain: ledgerhelp.com
- hash: 0f2c7194f1f577e73460db9ec2e75fc0c7f845588cbd4246333b7a4fbec90d9f
- hash: 4bee9affff9fa718a2c94f02ebe6a75143d4d461d291c2df9b769920fc927bf8
- hash: 7073b2a3a34525c5969921dd17ef1fa5607af92be78b3fc6129cdea73216691a
- hash: 918fa540126b7db6424652d84a5ce7e968947136db3d6e3e0cab30ea309e25a2
- hash: 961a398a5c71e837626b5fce68e44b14a5d220e3bd74a3d0ecd61a2762c38176
- hash: ba9d459169a303067a4fe36c8b8582a5ea023b9c270dafe89613bab840501b19
- url: http://136.0.213.184:1337/api/kraken-numio
- url: http://app.mona.co/api/passkeys/verify_option/
- url: http://macos-claude.com:8000
- url: https://app.mona.co
- domain: 36mcrypto.com
- domain: atechservicecentre.co.uk
- domain: ledger.com.lv
- domain: macos-claude.com
- domain: ses-noreply.com
- domain: xcjnrucne9xfvmci.com
Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline
Description
Researchers identified an exposed web directory on infrastructure supporting a cryptocurrency fraud operation tracked as Operation ASTERIX. The server contained phone-number datasets, account-validation tools, phishing panels, voice-dialing scripts, and fake wallet applications for Ledger, Trezor, and Exodus. The operator validated approximately 885,000 phone numbers against cryptocurrency exchange accounts, achieving a 13.6% hit rate on German numbers. Victims received coordinated phishing emails and vishing calls referencing fake support cases before being directed to counterfeit wallet applications designed to steal recovery phrases via Telegram exfiltration. Notable findings include extensive use of AI coding assistants throughout development, including GitHub Copilot and Claude Code. When one AI model resisted malicious requests, the operator switched providers and attempted to bypass safety controls using a structured jailbreak prompt targeting the model's reasoning patterns and safety mechanisms.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Researchers uncovered an exposed web directory supporting Operation ASTERIX, a cryptocurrency fraud operation. The server contained extensive resources including phone-number datasets, account-validation tools, phishing panels, voice-dialing scripts, and fake wallet applications for Ledger, Trezor, and Exodus. The operator validated approximately 885,000 phone numbers against cryptocurrency exchange accounts, with a 13.6% success rate on German numbers. Victims received coordinated phishing emails and vishing calls referencing fabricated support cases, leading them to counterfeit wallet applications designed to steal recovery phrases, which were exfiltrated via Telegram. The fraud operation used AI coding assistants such as GitHub Copilot and Claude Code extensively during development. When one AI model resisted malicious requests, the operator switched providers and used structured jailbreak prompts to bypass AI safety controls targeting the model's reasoning and safety mechanisms.
Potential Impact
The campaign enables attackers to steal cryptocurrency wallet recovery phrases through coordinated phishing and vishing attacks, potentially resulting in theft of victims' cryptocurrency assets. The use of validated phone numbers increases the likelihood of successful targeting. The counterfeit wallet applications facilitate direct theft of sensitive wallet credentials. The use of AI-assisted development and jailbreak prompts indicates a sophisticated approach to tool creation and evasion of AI safety mechanisms.
Defensive Guidance
No official patch or fix applies as this is a fraud campaign rather than a software vulnerability. Defenders should educate users about phishing and vishing tactics, especially related to cryptocurrency wallets. Users should verify communications purportedly from wallet providers or exchanges independently and avoid installing wallet applications from untrusted sources. Monitoring for the listed domains and hashes associated with the campaign can aid detection and blocking. Awareness of AI-assisted fraud tool development may inform threat hunting and defense strategies.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing/"]
- Pulse Id
- 6a840692bd27524cbf560e2d
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domainledgerhelp.com | — | |
domain36mcrypto.com | — | |
domainatechservicecentre.co.uk | — | |
domainledger.com.lv | — | |
domainmacos-claude.com | — | |
domainses-noreply.com | — | |
domainxcjnrucne9xfvmci.com | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash0f2c7194f1f577e73460db9ec2e75fc0c7f845588cbd4246333b7a4fbec90d9f | — | |
hash4bee9affff9fa718a2c94f02ebe6a75143d4d461d291c2df9b769920fc927bf8 | — | |
hash7073b2a3a34525c5969921dd17ef1fa5607af92be78b3fc6129cdea73216691a | — | |
hash918fa540126b7db6424652d84a5ce7e968947136db3d6e3e0cab30ea309e25a2 | — | |
hash961a398a5c71e837626b5fce68e44b14a5d220e3bd74a3d0ecd61a2762c38176 | — | |
hashba9d459169a303067a4fe36c8b8582a5ea023b9c270dafe89613bab840501b19 | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://136.0.213.184:1337/api/kraken-numio | — | |
urlhttp://app.mona.co/api/passkeys/verify_option/ | — | |
urlhttp://macos-claude.com:8000 | — | |
urlhttps://app.mona.co | — |
Threat ID: 6a842553bf8831d53988215d
Added to database: 08/18/2026, 09:26:43 UTC
Last enriched: 08/18/2026, 10:55:16 UTC
Last updated: 10/02/2026, 19:52:04 UTC
Views: 133
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.